Disclosure of any personal information, including someone’s membership in a voluntary student organization (school club), must be in accordance with Alberta’s access and privacy laws (the Acts).
The Freedom of Information and Protection of Privacy Act (FOIP Act) governs the collection, use and disclosure of personal information by public bodies. A public body includes a school board and charter school as defined in the Education Act (section 1(d) of the FOIP Act).
The Personal Information Protection Act (PIPA) applies to the collection, use and disclosure of personal information by provincially-regulated “organizations”, such as private schools, including those incorporated under Alberta’s Societies Act or registered under Part 9 of the Companies Act.
Under the FOIP Act and PIPA, personal information cannot be disclosed by public or private schools, except where authorized by the Acts. Even when authorized, such disclosures are discretionary – they enable the disclosure but they do not require it.
The Acts define personal information to mean “information about an identifiable individual” (section 1(n) of the FOIP Act; section 1(1)(k) of PIPA).
A student’s membership in a school club, such as a gay-straight alliance, is information about that student and is personal information to which the FOIP Act and PIPA apply.
Disclosure of Personal Information under the FOIP Act
Under the FOIP Act, personal information can only be disclosed in circumstances set out in the Act, including when:
- Disclosure would not be an unreasonable invasion of the individual’s personal privacy (section 40(1)(b))
- Disclosure will avert or minimize a risk of harm to the health or safety of a minor (section 40(1)(ee))
- Disclosure is authorized by another Act or regulation of Alberta or Canada (section 40(1)(f))
- Disclosure is to a public body or law enforcement agency in Canada to assist in an investigation undertaken with a view to a law enforcement proceeding (section 40(1)(q))
- The individual the information is about consents to the disclosure (section 40(1)(d))
Notwithstanding that a disclosure is authorized, a school may disclose personal information only to the extent necessary to enable it to carry out its purpose in a reasonable manner (section 40(4)).
Disclosure of Personal Information under PIPA
Under PIPA, personal information can only be disclosed with consent (section 7(1)(d)) or in circumstances set out in the Act, including when:
- A reasonable person would consider that the disclosure is clearly in the interests of the individual and consent cannot be obtained in a timely way or the individual would not reasonably be expected to withhold consent (section 20(a))
- Disclosure is authorized or required by another Act or regulation of Alberta or Canada (section 20(b))
- Disclosure is necessary to respond to an emergency that threatens the life, health or security of an individual or the public (section 20(g))
- Disclosure is reasonable for the purposes of an investigation or a legal proceeding (section 20(m))
Organizations can only disclose personal information for purposes that are reasonable, and only to the extent that is reasonable for meeting those purposes (section 19).
A school cannot require a student to consent to the disclosure of personal information beyond what is necessary (section 7(2)).
Both the FOIP Act and PIPA give individuals certain rights and powers, including the ability to consent to the disclosure of personal information.
If a school is relying on consent to disclose personal information, it must consider whether the personal information is about a mature minor (i.e. a minor who understands the implications of giving consent such that a school would need the student’s consent and not that of the parent to disclose).
If an individual is a minor, that individual’s rights under the FOIP Act may be exercised by a guardian of the minor in circumstances where, in the opinion of the head of the public body, the exercise of the right or power by the guardian would not constitute an unreasonable invasion of the personal privacy of the minor (section 84(1)(e)).
PIPA allows for the rights set out in the Act to be exercised by an individual under the age of 18, if the individual understands the nature of the right or power and the consequences of exercising the right or power. If the individual is under 18 years of age but does not meet these criteria, the rights and powers may be exercised by the guardian of the individual.
Individuals, including students, should be made aware of their rights under the Acts. A guardian may be required to provide evidence of his or her authority to exercise the rights of a minor.
Making a Complaint to the Commissioner
If a student feels a school has improperly disclosed their personal information, the student can submit a complaint to the Information and Privacy Commissioner. The Commissioner can order that any inappropriate disclosure stop.
Information about how to submit a complaint to the Commissioner is available at www.oipc.ab.ca.
This document is not intended as, nor is it a substitute for, legal advice, and is not binding on the Information and Privacy Commissioner of Alberta. Responsibility for compliance with the law (and any applicable professional or trade standards or requirements) remains with each organization, custodian or public body. All examples used are provided as illustrations. The official versions of the Freedom of Information and Protection of Privacy Act, Health Information Act and Personal Information Protection Act and their associated regulations should be consulted for the exact wording and for all purposes of interpreting and applying the legislation. The Acts are available on the website of the Alberta Queen’s Printer at www.qp.alberta.ca.